snakekeylogger | f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 22:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12_JC.exe
Size

542KB
MD5

fb6436801517f4cb1748ba4bf9df2df4
SHA1

2c36e323268892dc7f9987fb5200ee1fb2336df0
SHA256

f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12
SHA512

77140f0e92be4f7b931f33949ef4640b8d02bebcc43e0aec97618eb731efb07acb0648efcc10af630f2440bc2c8fa45b3862b8d77ce5c3f9d908ac9b22bf6977
SSDEEP

12288:5tHparD6dh85k4Y5hLZwi3qjnb7svMufuul8ZxeizmFzx:h4Dqh5LPwi3YnsUufuLnRmH

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

https://api.telegram.org/bot6316392918:AAHcjKTVDupG6SMH3LkXAeVBgHKlqsAcmRU/sendMessage?chat_id=6445748530

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 8 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1140-25-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1140-27-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1140-31-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1140-33-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1140-35-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1140-38-0x0000000000440000-0x0000000000480000-memory.dmp	family_snakekeylogger
behavioral1/memory/1140-44-0x0000000000440000-0x0000000000480000-memory.dmp	family_snakekeylogger
behavioral1/memory/2568-49-0x0000000002790000-0x00000000027D0000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 checkip.dyndns.org

flow	ioc
4	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12_JC.exe

description	pid	process	target process
PID 1936 set thread context of 1140	1936	f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12_JC.exe	f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

676 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12_JC.exepowershell.exepowershell.exe

pid process

1140 f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12_JC.exe
2568 powershell.exe
2476 powershell.exe

pid	process
676	schtasks.exe

pid	process
1140	f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12_JC.exe
2568	powershell.exe
2476	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12_JC.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1140	f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12_JC.exe
Token: SeDebugPrivilege	2476	powershell.exe
Token: SeDebugPrivilege	2568	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12_JC.exe

description	pid	process	target process
PID 1936 wrote to memory of 2568	1936	f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12_JC.exe	powershell.exe
PID 1936 wrote to memory of 2568	1936	f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12_JC.exe	powershell.exe
PID 1936 wrote to memory of 2568	1936	f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12_JC.exe	powershell.exe
PID 1936 wrote to memory of 2568	1936	f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12_JC.exe	powershell.exe
PID 1936 wrote to memory of 2476	1936	f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12_JC.exe	powershell.exe
PID 1936 wrote to memory of 2476	1936	f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12_JC.exe	powershell.exe
PID 1936 wrote to memory of 2476	1936	f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12_JC.exe	powershell.exe
PID 1936 wrote to memory of 2476	1936	f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12_JC.exe	powershell.exe
PID 1936 wrote to memory of 676	1936	f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12_JC.exe	schtasks.exe
PID 1936 wrote to memory of 676	1936	f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12_JC.exe	schtasks.exe
PID 1936 wrote to memory of 676	1936	f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12_JC.exe	schtasks.exe
PID 1936 wrote to memory of 676	1936	f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12_JC.exe	schtasks.exe
PID 1936 wrote to memory of 1140	1936	f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12_JC.exe	f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12_JC.exe
PID 1936 wrote to memory of 1140	1936	f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12_JC.exe	f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12_JC.exe
PID 1936 wrote to memory of 1140	1936	f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12_JC.exe	f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12_JC.exe
PID 1936 wrote to memory of 1140	1936	f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12_JC.exe	f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12_JC.exe
PID 1936 wrote to memory of 1140	1936	f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12_JC.exe	f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12_JC.exe
PID 1936 wrote to memory of 1140	1936	f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12_JC.exe	f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12_JC.exe
PID 1936 wrote to memory of 1140	1936	f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12_JC.exe	f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12_JC.exe
PID 1936 wrote to memory of 1140	1936	f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12_JC.exe	f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12_JC.exe
PID 1936 wrote to memory of 1140	1936	f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12_JC.exe	f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12_JC.exe

C:\Users\Admin\AppData\Local\Temp\f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12_JC.exe
"C:\Users\Admin\AppData\Local\Temp\f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1936

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12_JC.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2568

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\dSirXQFPjw.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2476

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dSirXQFPjw" /XML "C:\Users\Admin\AppData\Local\Temp\tmp343A.tmp"
2⤵
- Creates scheduled task(s)
PID:676

C:\Users\Admin\AppData\Local\Temp\f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12_JC.exe
"C:\Users\Admin\AppData\Local\Temp\f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12_JC.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp343A.tmp

Filesize
1KB

MD5
08d8a3eb2c5ea833381ae938b8b49027

SHA1
f2a844850fa7892da67af22324db83eace41ab86

SHA256
b60d27b40322e9e9486de743cfc48e7a36d1b7f3429a8483c8592675f24d790c

SHA512
5917ce7f49ec50522e18a5bd4626da1cc48c79627213a136553e7309202b34783bda8cea5778005b8a28d1e80eaae94d6b57d7e3ee581deef10bc08d122b48e1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DBHC6LI17ZIL03IWEYQ4.temp

Filesize
7KB

MD5
19ae26666166ce163dd056e862b2ee6f

SHA1
1948d4773c2d07b3d2dc9f405612bc3300720828

SHA256
2bfd2aa8a8688519d50d74f31fab5fe8067388b8c54660b30dc1fe2dfda289db

SHA512
17f8714f35f05f3d56a365d19ee237299bddb47a9f0f70f068c8b626e8dbeab2c86ba3154ca9dba0b6cbce92f49301ea514ae62a59496a19680d0a0535725ed7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
19ae26666166ce163dd056e862b2ee6f

SHA1
1948d4773c2d07b3d2dc9f405612bc3300720828

SHA256
2bfd2aa8a8688519d50d74f31fab5fe8067388b8c54660b30dc1fe2dfda289db

SHA512
17f8714f35f05f3d56a365d19ee237299bddb47a9f0f70f068c8b626e8dbeab2c86ba3154ca9dba0b6cbce92f49301ea514ae62a59496a19680d0a0535725ed7

Download Submit
memory/1140-36-0x0000000074790000-0x0000000074E7E000-memory.dmp

Filesize
6.9MB

Download
memory/1140-35-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1140-44-0x0000000000440000-0x0000000000480000-memory.dmp

Filesize
256KB

Download
memory/1140-38-0x0000000000440000-0x0000000000480000-memory.dmp

Filesize
256KB

Download
memory/1140-43-0x0000000074790000-0x0000000074E7E000-memory.dmp

Filesize
6.9MB

Download
memory/1140-33-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1140-31-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1140-29-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1140-27-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1140-21-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1140-23-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1140-25-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1936-37-0x0000000074790000-0x0000000074E7E000-memory.dmp

Filesize
6.9MB

Download
memory/1936-2-0x0000000074790000-0x0000000074E7E000-memory.dmp

Filesize
6.9MB

Download
memory/1936-3-0x0000000000BC0000-0x0000000000C00000-memory.dmp

Filesize
256KB

Download
memory/1936-8-0x0000000000AB0000-0x0000000000B10000-memory.dmp

Filesize
384KB

Download
memory/1936-7-0x0000000000530000-0x000000000053C000-memory.dmp

Filesize
48KB

Download
memory/1936-0-0x0000000074790000-0x0000000074E7E000-memory.dmp

Filesize
6.9MB

Download
memory/1936-1-0x0000000001070000-0x00000000010FE000-memory.dmp

Filesize
568KB

Download
memory/1936-6-0x0000000000420000-0x000000000042A000-memory.dmp

Filesize
40KB

Download
memory/1936-5-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1936-4-0x0000000000BC0000-0x0000000000C00000-memory.dmp

Filesize
256KB

Download
memory/2476-47-0x000000006E340000-0x000000006E8EB000-memory.dmp

Filesize
5.7MB

Download
memory/2476-40-0x000000006E340000-0x000000006E8EB000-memory.dmp

Filesize
5.7MB

Download
memory/2476-58-0x0000000002460000-0x00000000024A0000-memory.dmp

Filesize
256KB

Download
memory/2476-53-0x0000000002460000-0x00000000024A0000-memory.dmp

Filesize
256KB

Download
memory/2476-50-0x000000006E340000-0x000000006E8EB000-memory.dmp

Filesize
5.7MB

Download
memory/2476-46-0x0000000002460000-0x00000000024A0000-memory.dmp

Filesize
256KB

Download
memory/2568-48-0x000000006E340000-0x000000006E8EB000-memory.dmp

Filesize
5.7MB

Download
memory/2568-42-0x0000000002790000-0x00000000027D0000-memory.dmp

Filesize
256KB

Download
memory/2568-49-0x0000000002790000-0x00000000027D0000-memory.dmp

Filesize
256KB

Download
memory/2568-45-0x000000006E340000-0x000000006E8EB000-memory.dmp

Filesize
5.7MB

Download
memory/2568-51-0x0000000002790000-0x00000000027D0000-memory.dmp

Filesize
256KB

Download
memory/2568-52-0x0000000002790000-0x00000000027D0000-memory.dmp

Filesize
256KB

Download
memory/2568-39-0x000000006E340000-0x000000006E8EB000-memory.dmp

Filesize
5.7MB

Download
memory/2568-54-0x0000000002790000-0x00000000027D0000-memory.dmp

Filesize
256KB

Download
memory/2568-57-0x0000000002790000-0x00000000027D0000-memory.dmp

Filesize
256KB

Download
memory/2568-41-0x000000006E340000-0x000000006E8EB000-memory.dmp

Filesize
5.7MB

Download